The past several years have seen the introduction of new legislation concerning privacy and access to information. It is important to consider the impact such legislation has on information you may have about your employees, customers, competitors or the general public.
Privacy and access-to-information legislation has been around for years. Not all of it will apply to you. Nevertheless, it is important that you be familiar with such legislation in order to ensure that you are in compliance with whatever legislative scheme does apply to the information you hold as a business and an employer.
For provincially regulated private-sector employers in BC, the Personal Information Protection Act applies. For public bodies in BC, the Freedom of Information and Protection of Privacy Act applies. Finally, federally regulated employers are governed by the Personal Information Protection and Electronic Documents Act. Each of the three privacy statutes is briefly introduced below.
Personal Information Protection Act (PIPA)
PIPA came into force in BC on Jan. 1, 2004. It regulates the collection, use and disclosure of personal information by provincially regulated private sector organizations. This act applies to most employers.
The purpose of this Act is to govern the collection, use and disclosure of personal information by organizations in a manner that recognizes both the right of individuals to protect their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances.
In interpreting and applying PIPA, it is important to understand what we are talking about when we refer to "personal information." The definition is very broad and includes almost everything that is capable of identifying a particular individual. Generally speaking, personal information that you have about your employees must be collected, stored, used, and consented to in accordance with the act.
There are many exceptions in the act, however. The most important one regarding personal information about employees is the exception for "employee personal information," which is personal information reasonably required for the employment relationship. This may include information documented on the employee's resume and personnel file, such as performance issues, investigations or discipline, reference or background checks, and criminal record checks. Provided that the particular information falls within the statutory definition, employers are permitted to collect, use and disclose employee personal information without consent, provided that notice had been given to the employees in advance.
Other exceptions include contact information and work product information. Contact information is defined generally as information that enables an individual at a place of business to be contacted; it includes the individual's name, position, name or title, business telephone number, business address, business email or business fax number.
Work product information is information prepared or collected by individuals as part their responsibilities or activities related to their employment or business. In short, what individuals do at work is not personal information and is therefore excluded from the act.
To learn more about your specific responsibilities as either a private or public sector employer governed by PIPA, visit the Office of Information and Privacy Commissioner.
Other resources include tourism industry associations such as the BC & Yukon Hotels’ Association and the BC Lodging and Campgrounds Association, which can provide information about how the PIPA affects your business.
Freedom of Information and Protection of Privacy Act (FIOPPA)
Since 1993, public bodies in BC, including Crown corporations, health authorities, school boards and municipalities, have been subject to FOIPPA. This act imposes specific statutory requirements on a provincial public sector body's collection, use and disclosure of personal information. It also provides a general right of access to records in the custody or control of a public body.
The Act is intended to make public bodies more accountable to the public and to protect personal privacy by:
(a) giving the public a right of access to records,
(b) giving individuals a right of access to, and a right to request correction of, personal information about themselves;
(c) specifying limited exceptions to the rights of access;
(d) preventing the unauthorized collection, use or disclosure of personal information by public bodies; and,
(e) providing for an independent review of decisions made under this Act.
In October 2004, FOIPPA was amended to extend certain sections of FOIPPA to service providers. This refers to a person (or corporate entity) retained under a contract to perform services for a public body. As such, if your company operates under a contract with the provincial government, FOIPPA might apply to you.
In February 2005, the OIPC published a resource entitled "Protecting Personal Information Outside the Office". This publication may be of particular interest to you if your business operates largely outside of a traditional office setting. It applies to organizations governed by either PIPA or FOIPPA. Various other helpful resources concerning the interpretation and application of FOIPPA can be found on OIPC.
Personal Information Protection and Electronic Documents Act (PIPEDA)
PIPEDAregulates the collection, use and disclosure of personal information in the course of federally regulated commercial activities. As such, PIPEDA applies to federally regulated private-sector employers operating in British Columbia. It also applies to the inter-provincial flow of personal information.
The Act is intended to recognize and protect the right of privacy of individuals with respect to their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances.
PIPEDA is administered through the Office of the Privacy Commissioner of Canada. The OPC provides a great deal of valuable resources on its website concerning the application and interpretation of the act, as well as news, case summaries and practical advice. If you are a federally regulated employer, you are encouraged to visit the Office of the Privacy Commissioner of Canada to learn more about PIPEDA.
Information provided by HARRIS & COMPANY. For more information about HARRIS & COMPANY, please visit harrisco.com.